Security posture Secrets stay out of web roots. TLS is assumed at the edge. Admin surfaces remain role-gated.